Introduction to Data Protection / GDPR

Laura Withers, Information Compliance Officer Data Protection in the news

Brexit: UK seeks data from EU

By Chris Baraniuk Technology reporter

24 August 2017

Brexit

MILLIONS OF EUROPEANS AFFECTED BY FACEBOOK DATA SCANDAL, EU REVEALS

Data protection authorities across Europe will work to investigate claims of data abuse

ANDREW GRIFFIN @\_andrew_griffin 5 days ago

Carphone Warehouse fined £400,000 for putting millions of customers’ data at risk

Data included names, addresses, phone numbers, dates of birth, marital status and – for more than 18,000 customers – historical payment card details

Josie Cox Business Editor | @JosieCox_London | Wednesday 10 January 2018 11:02 GMT | 2 comments Remember the 1990s? Data Protection Regulations

- Data Protection Act 1998
- General Data Protection Regulation (EU)
- Data Protection Bill (UK) Meaning of Personal Data

Article 4(1) GDPR:

- “Personal data” means any information relating to an identified or identifiable natural person (“data subject”)

- The data you hold may identify an individual directly or indirectly, when viewed in combination with other data Special category personal data

- Racial or ethnic origin

- Political opinions

- Religious or philosophical beliefs

- Membership of a trade union

- Genetic data

- Biometric data

- Health/medical data

- Sex life and sexual orientation Benefits of GDPR for the individual

Improved Security + Transparency = Knowledge, Confidence & Trust GDPR Principles

- GDPR principles more or less the same as Data Protection Act Principles

**Why** are you collecting personal data? – What is the **lawful basis** for this?

**What is the purpose?**

**Minimise** collection

**Keep** accurate

**Limit** retention

**Store** securely

Transparency Right of Access

- Data Subjects (a ‘natural person’) can submit a **Subject Access Request** to the University

- Entitled to receive a copy of all their personal data held by the University, wherever they can be identified

- **Free of charge**, unless the request is “manifestly unfounded or excessive”

- 30 Calendar days Accountability

- Information Commissioner’s Office is the UK’s regulator for GDPR

- They can issue fines to organisations who breach data

- Take care of data to prevent breaches

- Damage to the individual

- Reputational damage How can you prepare for GDPR?

- Complete the training module

- Know your Information Custodian

- Be aware when you are handling personal data

- Put yourself in the position of the individual whose data you are processing

Contact us for advice: datapro@kent.ac.uk References

Slide 2: Brexit: UK seeks data transfer pact with EU: [http://www.bbc.co.uk/news/technology-41036551](http://www.bbc.co.uk/news/technology-41036551) Carphone Warehouse data breach: [https://www.independent.co.uk/news/business/news/carphoe-warehouse-fined-customer-data-risk-millions-ico-cyber-security-a8151166.html](https://www.independent.co.uk/news/business/news/carphoe-warehouse-fined-customer-data-risk-millions-ico-cyber-security-a8151166.html) Millions of Europeans affected: [https://www.independent.co.uk/life-style/gadgets-and-tech/news/facebook-cambridge-analytica-personal-data-european-europe-am-i-affected-a8291656.html](https://www.independent.co.uk/life-style/gadgets-and-tech/news/facebook-cambridge-analytica-personal-data-european-europe-am-i-affected-a8291656.html)

Slide 3: Mobile phone photo: [http://www.mobilephonehistory.co.uk/networks/payg.php](http://www.mobilephonehistory.co.uk/networks/payg.php); Windows 95 PC photo: [http://uk.businessinsider.com/microsoft-windows-95-software-turns-20-2015-8](http://uk.businessinsider.com/microsoft-windows-95-software-turns-20-2015-8)

Slide 5: Personal information form image: [https://www.stationx.net/list-of-personally-identifiable-information-pii/](https://www.stationx.net/list-of-personally-identifiable-information-pii/)

Slide 6: Confidential file image: [https://www.itgovernance.eu/blog/en/gdpr-trilogue-satisfying-agreement-on-eu-data-protection-law/](https://www.itgovernance.eu/blog/en/gdpr-trilogue-satisfying-agreement-on-eu-data-protection-law/)

Slide 7: My Data folder image: [https://crosspointecg.com/cybersecurity/](https://crosspointecg.com/cybersecurity/)

Slide 8: Transparency image: [https://www.affiliateroyale.com/2017/05/transparency-in-affiliate-marketing/](https://www.affiliateroyale.com/2017/05/transparency-in-affiliate-marketing/)

Slide 9: Unlocking data image: [http://www.teach-ict.com/2016/GCSE_Computing/OCR_J276/1_6_network_security/preventing_vulnerabilities/miniweb/pg2.php](http://www.teach-ict.com/2016/GCSE_Computing/OCR_J276/1_6_network_security/preventing_vulnerabilities/miniweb/pg2.php)

Slide 10: ICO fines newspaper image: [http://www.tpsservices.co.uk/tps-news/2014/11/14/ico-fine-campaign-part-1.aspx](http://www.tpsservices.co.uk/tps-news/2014/11/14/ico-fine-campaign-part-1.aspx)

Slide 11: “It starts with you” image: [http://www.jillchristensenintl.com/2017/06/22/millennials-are-not-to-blame-take-accountability-leaders/](http://www.jillchristensenintl.com/2017/06/22/millennials-are-not-to-blame-take-accountability-leaders/)

Information taken from: Information Commission’s Office website: [www.ico.org.uk](http://www.ico.org.uk); ICO News Blog: [https://iconewsblog.org.uk/2017/08/09/gdpr-sorting-the-fact-from-the-fiction/](https://iconewsblog.org.uk/2017/08/09/gdpr-sorting-the-fact-from-the-fiction/) BBC Radio 4, Money Box Live: GDPR and What it means for you: [https://www.bbc.co.uk/programmes/b09xcshq](https://www.bbc.co.uk/programmes/b09xcshq)